Office 2007 is a problem for me.

[Steve Basford]

> Hello,
>
> MailScanner is working wonderfully, except for Office 2007 files.  I find
> that a lot of these files contain other blocked file contents, and are
> treated just like any other archive.  Has anyone found a way to deal with
> these types of files without having to white list extensions that are
> known
> to be bad?  I'd rather not have to allow *.bin , *.wmf or *.dat files
> through my mailscanner.

As DOCX are zip files they start (PK) 504B and the docx files seems to have
this common hex as the beginning:

130008025B436F6E74656E745F54797065735D2E786D6C20A2040228A0

So perhaps that could be used to tell the difference between it.. and a
normal Zip archive?

I'll go back to lurking now ;)

Cheers,

Steve
Sanesecurity